Anti-DDoS:Anti-DDoS Origin 2.0 (subscription)

Choose an instance type

Anti-DDoS Origin 2.0 (subscription) offers two instance types: Inclusive Edition for Small and Medium Enterprises and Enterprise Edition. Each type provides two protection modes: Insurance mode and Worry-free mode.

Use the following criteria to select an instance type:

• Inclusive Edition for Small and Medium Enterprises: Assets are in a single region, fewer than 30 IP addresses need protection, and clean bandwidth does not exceed 1,000 Mbps.

• Enterprise Edition: Assets span multiple regions, more than 30 IP addresses need protection, or the assets include both IPv4 and IPv6 addresses.

Billing items

Total cost = Subscription fee (protection feature fee + bandwidth fee + IP quantity protection fee) + Pay-as-you-go fee (burstable clean bandwidth fee).

Estimate your clean bandwidth requirements

Before purchasing, estimate your 95th percentile bandwidth to select the right baseline clean bandwidth.

Sample inbound and outbound traffic at 5-minute intervals. For each interval, calculate the average inbound and outbound bandwidth and take the higher value as the bandwidth for that sample. At the end of the month, sort all sample values in descending order and remove the top 5%. The highest remaining value is your 95th percentile bandwidth — use it as your baseline clean bandwidth reference.

The following diagram illustrates billable bandwidth over a 30-day period.

Mitigation sessions

The system records a traffic data point every 5 seconds (12 per minute). When attack traffic exceeds the threshold N Gbps, the system starts accumulating attack duration (shown as X+Y in the figure below). One mitigation session is consumed for every 15 minutes of accumulated attack time (equivalent to 180 data points).

The red line represents the inbound traffic of an asset with a public IP address.

The attack threshold N differs by location:

• Assets in the Chinese mainland: N = 20 Gbps

• Assets outside the Chinese mainland: N = 10 Gbps

Example: A Chinese mainland asset experiences two attacks exceeding 20 Gbps — one lasting 10 minutes, another lasting 12 minutes (22 minutes total). The first session is consumed after the initial 15 minutes. The remaining 7 minutes carry over toward a second session. If additional attacks accumulate another 8 minutes in the same month, the second session is consumed.

To check remaining mitigation sessions, see Query remaining mitigation sessions for Inclusive Edition for Small and Medium Enterprises.

Bandwidth overage

Anti-DDoS Origin allows clean traffic to temporarily exceed the instance's clean bandwidth. When cumulative overage duration reaches the following milestones within a month, Alibaba Cloud sends an alert through your configured notification channels. Alerts are sent on the morning of T+1 day.

After the 36-hour overage alert, restore Anti-DDoS Origin mitigation using one of the following methods:

• Method 1: Wait for automatic recovery at the start of the next month.

• Method 2 (Enterprise instances only): Enable burstable clean bandwidth. Recovery is immediate. Total clean bandwidth becomes 5× the baseline.

• Method 3: Upgrade the baseline clean bandwidth. Recovery is immediate.

View overage details in the Billing Center.

Overdue payments

An overdue payment occurs when your available balance — including cash, coupons, and vouchers — is insufficient to cover outstanding bills. Top up your account promptly to prevent service interruptions.

Instance expiration

Refund policy

Refunds are not supported after purchasing an instance.

Query bills

Query bills in the Expenses and Costs console. For more information, see Monthly bill overview. For more information, see Monthly Bill Overview.